Example #1
0
        private void DumpCrimBlock(BinaryReader r)
        {
            var header = r.ReadStruct <FileHeader>();

            VerifyMagic(0, header.Magic, CrimsonTags.CRIM);

            writer.PushDictScope("CRIM");
            writer.WriteHex("Magic", header.Magic);
            writer.WriteNumber("Length", header.Length);
            writer.WriteNumber("Major", header.Major);
            writer.WriteNumber("Minor", header.Minor);
            writer.WriteNumber("NumProviders", header.NumProviders);

            var providerEntries = new List <ProviderEntry>();

            for (uint i = 0; i < header.NumProviders; ++i)
            {
                var provider = r.ReadStruct <ProviderEntry>();
                providerEntries.Add(provider);
                writer.WriteLine("Provider(Guid={0}, Offset=0x{1:X})", provider.Guid, provider.Offset);
            }

            foreach (var entry in providerEntries)
            {
                r.BaseStream.Position = entry.Offset;
                DumpWevtBlock(r, entry.Guid);
            }

            writer.PopScope();
        }
        private void DumpCrimBlock(byte *r)
        {
            var header = (FileHeader *)r;

            VerifyMagic(0, header->Magic, CrimsonTags.CRIM);

            writer.PushDictScope("CRIM");
            writer.WriteHex("Magic", header->Magic);
            writer.WriteNumber("Length", header->Length);
            writer.WriteNumber("Major", header->Major);
            writer.WriteNumber("Minor", header->Minor);
            writer.WriteNumber("NumProviders", header->NumProviders);

            var providerEntries = new List <ProviderEntry>();

            for (uint i = 0; i < header->NumProviders; ++i)
            {
                var provider = ((ProviderEntry *)&header[1]) + i;
                providerEntries.Add(*provider);
                writer.WriteLine("Guid={0}, Offset=0x{1:X}", provider->Guid, provider->Offset);
            }

            foreach (var entry in providerEntries)
            {
                DumpWevtBlock(begin + entry.Offset, entry.Guid);
            }

            writer.PopScope();
        }